PCA-based multivariate statistical network monitoring for anomaly detection

The multivariate approach based on Principal Component Analysis (PCA) for anomaly detection received a lot of attention from the networking community one decade ago, mainly thanks to the work of Lakhina and co-workers. However, this work was criticized by several authors who claimed a number of limi...

Full description

Saved in:
Bibliographic Details
Published in:Computers & security 2016-06, Vol.59, p.118-137
Main Authors: Camacho, José, Pérez-Villegas, Alejandro, García-Teodoro, Pedro, Maciá-Fernández, Gabriel
Format: Article
Language:English
Subjects:
Anomalies
Anomaly detection
Chemometrics
Communities
Computer information security
Computer networks
Experimentation
Monitoring
Multivariate analysis
Multivariate statistical process control
Network monitoring
Network security
Principal component analysis
Principal components analysis
Process controls
Proposals
Statistical process control
Studies
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The multivariate approach based on Principal Component Analysis (PCA) for anomaly detection received a lot of attention from the networking community one decade ago, mainly thanks to the work of Lakhina and co-workers. However, this work was criticized by several authors who claimed a number of limitations of the approach. Neither the original proposal nor the critic publications were completely aware of the established methodology for PCA anomaly detection, which by that time had been developed for more than three decades in the area of industrial monitoring and chemometrics as part of the Multivariate Statistical Process Control (MSPC) theory. In this paper, the main steps of the MSPC approach based on PCA are introduced; related networking literature is reviewed, highlighting some differences with MSPC and drawbacks in their approaches; and specificities and challenges in the application of MSPC to networking are analyzed. All of this is demonstrated through illustrative experimentation that supports our discussion and reasoning.
ISSN:0167-4048
1872-6208
DOI:10.1016/j.cose.2016.02.008